Lightlesscan

LightlessCan is a new and advanced malware, discovered by ESET, that has been added to North Korea's Lazarus group's arsenal. The malware is a successor to the group's flagship HTTP(S) Lazarus Remote Access Trojan (RAT) named BlindingCan. LightlessCan represents a significant advancement in malicious capabilities compared to its predecessor, with ESET's senior malware researcher, Peter Kálnai, noting that it mimics the functionalities of a broad range of native Windows commands. This allows for discreet execution within the RAT itself, making detection and analysis of attacker activities more challenging. The threat actor initially gained access to company systems through a spear-phishing attack masquerading as a recruiter for Facebook parent company Meta. Once inside the system, they deployed the LightlessCan malware. One of the most notable aspects of this RAT is its ability to mimic commands like ping, ipconfig, systeminfo, sc, net, and others with a hardcoded "The operation completed successfully" string as output. This obfuscates the reality of what the RAT is doing, adding another layer of complexity to its operations. ESET's analysts believe that LightlessCan is based on the source code of BlindingCan due to the significant preservation of the order of shared commands, despite some differences in their indexing. In developing LightlessCan, Lazarus may have reverse-engineered the closed-source system binaries to add additional functionality to the RAT. In a recent attack documented by ESET, LightlessCan demonstrated support for 68 commands, although only 43 appear to be implemented. The discovery of this malware came after Lazarus Group impersonated a Meta recruiter on LinkedIn to target a Spain-based aerospace firm with the LightlessCan malware.